Audit-Proof Batch Release: The QP Guide to Annex 16 and QRM (Annex 20)

The Loneliness of the Qualified Person

Few moments in the world of GMP are as charged with responsibility as the moment a Qualified Person (QP) signs a batch to certify it. That signature isn't an administrative act; it's a personal declaration certifying that the batch complies with GMP and the Marketing Authorization (MA).

In the EU, the QP is the ultimate "gatekeeper" of quality and patient safety. But the QP can't be everywhere. So how can they certify a batch produced in a CMO (Contract Manufacturing Organization) thousands of miles away? How can they handle a minor deviation from the dossier without blocking the supply chain?

The answer lies in the combined application of two regulatory pillars: Annex 16 (QP and Batch Release) and Annex 20 (Quality Risk Management - ICH Q9) .

In the context of global supply chains and increasing audit scrutiny, QP must use QRM not as a theoretical exercise, but as its primary decision-making tool to make the release process audit-proof.

🛡️ Annex 16: The QP Legal and Operational Shield

Annex 16 (2016 revision) recognizes the complexity of the modern QP role and provides a framework for managing accountability. It doesn't expect the QP to rerun tests, but to trust a system . Their job is to ensure that the system is robust.

1. The Global Supply Chain Problem: "Reliance on Third Parties"

The QP rarely sees the entire process. Annex 16 (Section 2) allows the QP to "rely" on third-party GMP assessments (e.g., the CMO's QP, or an auditor).

What inspectors look for: A "Quality Agreement" isn't enough. The inspector will ask the QP how they verified the subcontractor's reliability.

• Audit-Proof Action: The QP must have access to and actively review audit reports from critical suppliers. A 2025 EMA Q&A even specified that the QP must provide a "written assessment and approval" of these reports. It's not enough that the audit was "performed" by the QA.

2. The Import Dilemma (MRA vs. Non-MRA)

Annex 16 is clear:

• With MRA (Mutual Recognition Agreement): The importer's QP can rely on the "Batch Certificate" of the equivalent QP in the MRA country (e.g., Canada). A full retest is not required.
• Without MRA (e.g., India, China): The importer's QP has full responsibility. Each batch must undergo full testing in the EU (complete qualitative analysis, API quantification, and any other necessary tests).

What inspectors look for:

• They verify that batches imported from non-MRA countries have actually been fully retested in Europe. Skipping "confidence" tests on the manufacturer's CoA is a critical point.

🧠 Annex 20 (ICH Q9 R1): The Decision-Making Brain of QP

If Annex 16 defines what to do, Annex 20 (which adopts ICH Q9) defines how to think. The recent 2023 revision of ICH Q9 (R1) introduced concepts that appear tailor-made for QP.

1. Managing Subjectivity (Section 5.3)

QPs often have to make decisions with incomplete data. The R1 review acknowledges that human bias and subjectivity are a risk.

• Audit-Proof Action: The QP cannot base a decision solely on "experience" or "gut feeling." It must document the rationale for that decision, using data, multidisciplinary teams, and objective risk scales (avoiding arbitrary FMEA scores).

2. The Continuum of Formality (Section 5.1)

Not all risks are equal, and Annex 20 (R1) formalizes this. A 30-page FMEA isn't necessary for a minor printing error on secondary packaging.

• Audit-Proof Action: The QP must adjust the QRM effort proportionately to the risk (Principle 2 of ICH Q9). A "lean" (but documented) QRM is acceptable for low risks. The important thing is to justify why a less formal approach was chosen.

3. Product Availability Risk (Shortage) (Section 6.1)

This is a key point for QP. ICH Q9 (R1) now formally recognizes that drug shortages pose a risk to the patient.

• Audit-Proof Action: The QP often finds itself balancing a quality risk (e.g., a minor deviation) with the risk of a shortage. This review justifies the inclusion of "shortage risk" in the risk assessment.

⚖️ The Practical Case: Release with Deviations ("Concession")

This is the most feared inspection scenario, where Annex 16 and 20 merge.

Scenario: A batch is ready. QC tests are compliant. But production experienced a deviation: a process parameter (e.g., mixing time) was slightly outside the range set in the Marketing Authorization (MA). The finished product, however, meets all specifications.

What to do?

• The Mistake (pre-Annex 16): Releasing "ignorantly" or blocking the batch, causing a shortage.
• Corrective Action (Annex 16 + 20):
1. Annex 16 (Section 3) allows the QP to assess "unexpected deviations".
2. The QP initiates a QRM (Annex 20) to assess the impact. The "Hazard Identification" (ICH Q9 R1) is not about the parameter, but about the impact on the patient.
3. The analysis (FMEA or other) concludes that, since the specifications (CQA) are met, the risk to the patient is low.
4. The QP documents this QRM, approves it, and can certify the batch.
5. Crucial step: This cannot be the norm. The company must initiate a CAPA and, if the deviation is recurring, a change to the AIC to update the range.

What inspectors look for: Inspectors (as seen in Section 7.5) will search the "licensing log." If they see that the QP frequently releases batches with deviations without initiating variations, a critical finding for non-compliance with the AIC is triggered.

🚨 Audit Readiness: 4 Critical Mistakes to Avoid for QP

From the inspection examples (Section 7.5), 4 "red flags" emerge for inspectors:

1. Releasing batches with open OOS: The most serious finding. A QP can never certify a batch with an uncompleted and unexplained Out-of-Specification (OOS).
2. Paper-based audits of third-party suppliers: Relying on an outdated (e.g., >3 years old for a critical supplier) or incomplete audit. The QRM (Annex 20) must define the audit frequency.
3. "Invisible" QP: A QP who is not involved in the Change Control, deviation management, or recall processes. Annex 16 and Chapter 8 of GMP require the QP to be informed immediately of critical defects.
4. Failure to Review PQRs: The QP must use the Annual Product Quality Review (PQR) as a QRM tool for the “Risk Review”, to confirm that processes remain in control.

✅ Conclusion: From Lonely Guardian to Orchestra Conductor

The role of the QP has evolved. It is no longer an isolated final controller, but a "conductor" who must ensure that the entire quality system (QMS) functions harmoniously.

Annex 16 is its score (responsibilities), Annex 20 (QRM) is its baton (decision-making tool).

To be "audit-proof", the QP must demonstrate that each of its decisions, especially that of releasing a complex batch, is supported by a documented, scientific and proportionate QRM process.

Our comprehensive operational guide provides the QP with the detailed checklists (such as the one in Sec. 7.6) and QRM templates (Sec. 8.6) needed to document these decisions and approach any inspection with confidence.

Keep your company audit-ready. Discover the complete guide at GuideGxP.com